SIEM Investigation: DNS Exfiltration Trace

Prerequisites

• COA-K005: C2 Beaconing & DNS Exfiltration Detection
• FND-K005: DNS Internals & Anomaly Detection

Why This Lesson Matters

DNS exfiltration is consistently one of the most underdetected attack techniques because it hides in a protocol that is universally permitted outbound. This lesson is a focused deep-dive: how to confirm DNS exfiltration from SIEM log evidence, how to reconstruct the payload, and how to write an investigation finding.

1. Confirming DNS Exfiltration: A Structured Approach

When your SIEM fires a "suspicious DNS activity" alert, confirm or deny DNS exfiltration with these five checks:

Check 1: Volume — is the query count unusually high for this domain?
  Normal: 5–20 queries/hour for a business domain
  Suspicious: > 100 queries/hour to one second-level domain

Check 2: Label length — are subdomain labels longer than normal?
  Normal: 3–20 characters (www, api, mail, static-cdn)
  Suspicious: > 30 characters

Check 3: Entropy — are the subdomain labels high-entropy (random-looking)?
  Normal: entropy < 3.0 bits/char (words, abbreviations)
  Suspicious: entropy > 3.5 bits/char (base32/base64 encoded data)

Check 4: NXDOMAIN — is the host generating many failed lookups?
  DGA: many NXDOMAIN per hour
  DNS exfil: mostly NOERROR (the exfil domain resolves to something)

Check 5: Timing — are queries evenly spaced? Do they cluster around write operations?
  Beacon-style DNS exfil: regular intervals
  Burst-mode exfil: large number of queries in a short window

2. Extracting and Reconstructing the Payload

2.1 From SIEM Logs (JSON)

import json, base64, subprocess

# Load DNS log file (JSONL format)
queries = []
with open("dns_logs.jsonl") as f:
    for line in f:
        ev = json.loads(line)
        if "exfil.evil.com" in ev.get("dns_qry_name", ""):
            queries.append({
                "ts": ev["timestamp"],
                "name": ev["dns_qry_name"]
            })

# Sort by timestamp
queries.sort(key=lambda x: x["ts"])

# Extract subdomain labels
labels = [q["name"].replace(".exfil.evil.com", "") for q in queries]

# Concatenate and decode
payload = "".join(labels)
print("Raw concatenated:", payload)

# Try Base32
try:
    decoded = base64.b32decode(payload.upper() + "=" * (8 - len(payload) % 8))
    print("Base32 decoded:", decoded)
except Exception as e:
    print("Not Base32:", e)

# Try Base64 URL-safe
try:
    decoded = base64.urlsafe_b64decode(payload + "==")
    print("Base64 decoded:", decoded)
except Exception as e:
    print("Not Base64:", e)

2.2 From PCAP

# Extract exfil queries in timestamp order
tshark -r dns_exfil.pcap 
  -Y "dns.qry.name contains "exfil.evil.com" and dns.flags.response==0" 
  -T fields -e frame.time_epoch -e dns.qry.name 
  | sort -n -k1 
  | awk '{print $2}' 
  | sed 's/.exfil.evil.com$//' 
  | tr -d '
' 
  | base32 -d 2>/dev/null

3. Shannon Entropy Calculation

Entropy quantifies the randomness of a string. A legitimate subdomain like www has low entropy. A base32-encoded payload has high entropy.

import math, collections

def entropy(s):
    if not s:
        return 0
    freq = collections.Counter(s.lower())
    total = len(s)
    return -sum((c/total) * math.log2(c/total) for c in freq.values())

# Examples
print(f"'www'       entropy: {entropy('www'):.2f}")          # ~1.58
print(f"'mailrelay' entropy: {entropy('mailrelay'):.2f}")    # ~2.75
print(f"'aGVsbG8='  entropy: {entropy('aGVsbG8='):.2f}")    # ~3.50
print(f"'ONQWW23F'  entropy: {entropy('ONQWW23F'):.2f}")    # ~3.50+

# Apply to all subdomains in your log
# Threshold: > 3.5 = suspicious

4. Correlation: Exfiltration Source to Internal Activity

Once you confirm DNS exfiltration, pivot to internal evidence:

DNS exfil source: 10.0.0.42

→ Check auth.log / Windows Security log for 10.0.0.42 activity in same window
→ Check Sysmon for processes on 10.0.0.42 that made DNS queries
  (Sysmon Event 22 — DNSEvent — shows which process issued the query)
→ Check EDR for file access on 10.0.0.42 around the exfil window
  (What files were read before the DNS burst?)
→ Check process tree: which process issued the DNS queries?
  (Sysmon Event 22 field: QueryName, ProcessGuid)

Sysmon Event 22 example:
  QueryName: ONQWW23F.exfil.evil.com
  Image: C:UsersobAppDataLocalTempupdate.exe
  ProcessGuid: {abc123...}

This pivot connects the network exfiltration to a specific process and binary on the endpoint.

5. Investigation Note Template: DNS Exfiltration

Investigation Finding — DNS Exfiltration Confirmed
Date: 2026-06-08 | Analyst: [Name]

Alert: SIEM — "High-entropy DNS queries detected from 10.0.0.42"

Summary:
Host 10.0.0.42 exfiltrated data via DNS tunnelling to attacker-controlled
domain exfil.evil.com between 14:30 and 15:02 UTC.

Evidence:
- 847 DNS queries to *.exfil.evil.com from 10.0.0.42 (14:30-15:02 UTC)
- Average subdomain label length: 38 chars (normal: < 20)
- Shannon entropy of labels: 3.82 bits/char (threshold: > 3.5)
- Reconstructed payload (Base32): [content summary / classified]
- Sysmon Event 22: queries issued by C:Tempupdate.exe (PID 3892)
- update.exe SHA256: a3f9b2... (VirusTotal: 41/90 malicious, family: CobaltStrike)

CIA Impact: Confidentiality (data exfiltrated)
ATT&CK: T1048.003 — Exfiltration Over Alternative Protocol: DNS
Severity: P1 — Critical (active exfiltration)

Recommended Actions:
1. Isolate 10.0.0.42 immediately
2. Block exfil.evil.com and parent domain at DNS resolver
3. Escalate to IR team for full forensic investigation
4. Notify DPO if exfiltrated data contains personal information (PIPEDA/Law 25)

6. Common Mistakes

Mistake 1: Assuming Base32 without checking. DNS exfil tools use Base32, Base64, hex, and custom alphabets. Try all common encodings before concluding the payload is unreadable.

Mistake 2: Not sorting queries by timestamp before reconstruction. SIEM log exports may not be in packet order. A mis-ordered concatenation produces garbage and makes the payload look unreadable when it is actually fully recoverable.

Mistake 3: Blocking only the exfil domain without investigating the source process. Blocking exfil.evil.com removes this exfil channel. It does not remove the malware. The process will likely switch to another C2 method within minutes.

7. Practice Exercises

1. Calculate the Shannon entropy of these subdomain labels: static, aGVsbG8=, ONQWW23FMNQHIZLTOQQGK3TF. Which are suspicious?

2. You have 150 DNS query names from a suspected exfiltration. They all end in .update-stats.net. The subdomains are: MFRA====, OJUW====, MZXW==== (truncated). What encoding is this? Decode the first three labels.

3. Sysmon Event 22 shows that DNS queries to the exfil domain were issued by C:WindowsSystem32svchost.exe. Does this change your investigation approach? Why?

8. Lab

Assessment mode: flag

challenge_spec_id: 372 — DNS exfiltration trace

You are given a dns_logs.jsonl file from a SIEM export.

Task: 1. Identify the exfiltration domain (high query count + high entropy subdomains) 2. Extract all subdomain labels in timestamp order 3. Concatenate and decode (Base32) the payload 4. The decoded payload contains the flag in PREFIX{...} format

9. Framework Alignment

10. Further Reading

• iodine DNS tunnel — https://code.kryo.se/iodine/ — Read the source to understand DNS tunnel encoding
• dnscat2 — https://github.com/iagox86/dnscat2 — C2-over-DNS; understanding the tool improves detection
• SANS Whitepaper: Detecting DNS Exfiltration — Comprehensive academic treatment
• Cloudflare DNS Security blog — Practical perspective on DNS anomaly detection at scale

["Apply the five-check DNS exfiltration confirmation framework to a set of SIEM DNS log data and produce a justified verdict (exfiltration confirmed / not confirmed)", "Calculate Shannon entropy in Python for a set of subdomain labels and classify them as normal (<3.0), borderline (3.0-3.5), or suspicious (>3.5)", "Reconstruct a Base32-encoded DNS-exfiltrated payload from a time-sorted SIEM log export and produce a complete investigation finding note"]

Prerequisites → Why this matters → Five-check DNS exfiltration confirmation framework → Payload extraction from SIEM logs (Python) and from PCAP (tshark) → Shannon entropy calculation → Internal correlation (Sysmon Event 22 pivot) → Investigation note template → Common mistakes → Practice exercises → Lab (flag, spec 372) → Framework alignment → Further reading